CVE-2024-3371highCWE-360

CVE-2024-3371: high-severity vulnerability in MongoDB Compass

Insufficient validation of external input in Compass may enable MITM attacks

Published · Updated

Follow this CVE+ Monitor MongoDB Compass

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.2%
MongoDB Compass may accept and use insufficiently validated input from an untrusted external source. This may cause unintended application behavior, including data disclosure and enabling attackers to impersonate users. This issue affects MongoDB Compass versions 1.35.0 to 1.42.0.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Affected products
MongoDB Inc · MongoDB Compass
Related CVEs — MongoDB Compass

In the same product, most dangerous first.

CVE-2024-6376HIGHejson shell parser in MongoDB Compass maybe bypassedEPSS 0.5%CVE-2025-1755HIGHMongoDB Compass may be susceptible to local privilege escalation in WindowsEPSS 0.1%